Use this for one legal entity at a time; groups run it per entity, then compare. You get two files in a new folder, ./ict-risk-framework-check/: a spreadsheet you can open in Excel with one row per DORA topic, showing which document or record covers it, the gap, its severity and a proposed owner (gap-register.csv), and a short summary for the management body with the gaps that matter most and the decisions only it can take (summary.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The check reads documents and records; it is not a legal opinion, and it does not decide what the competent authority will accept.

Inputs to gather

Read the entity's licence or authorisation type, group structure, the ICT risk management framework document (if one exists), the digital operational resilience strategy, the ICT and information security policies, the asset and ICT service inventories, the business continuity and backup documents, incident records, internal audit reports on ICT, management body minutes that discuss ICT risk, and any existing security certification scope. Ask the reader: which entity type and competent authority apply, whether the entity is a microenterprise, and whether any supervisor letter or inspection is open.

Step 1: settle applicability and proportionality

Confirm the entity type falls within DORA's scope (Article 2) and record it. DORA has applied since 17 January 2025 (Article 64), so every gap is a live obligation to remediate, not preparation. Check whether the entity is one of the categories listed for the simplified ICT risk management framework (Article 16); if it is, check against that regime, not the full one. Size alone does not move an entity there: a microenterprise stays under the full framework, with lighter duties in some articles (for example periodic rather than yearly review of the framework, no separate control function or internal audit of it). Note proportionality (Article 4): size, risk profile and the nature of services shape how much is expected. Where unclear, run a framework lookup or mark it for the entity's legal function. The regulatory technical standards on the ICT risk management framework (Commission Delegated Regulation (EU) 2024/1774) carry the operative detail for protection, detection and continuity; run a framework lookup for that detail rather than inferring it.

Step 2: map evidence article by article

Build the gap spreadsheet (gap-register.csv) with one row per topic below, and columns: article, topic, the entity's document or record that covers it, evidence it operates, cadence and date last done, gap, severity, proposed owner, proposed action.